When AI Can Fool a Security Camera: What Businesses Need to Know

Security cameras are often described as if they see and understand the world in one step. They do not. A lens and image sensor capture light. Software then processes the resulting frames, perhaps looking for a person, a vehicle, a number plate, a face, a direction of travel or an unusual event. An alert is usually the end of that chain, not a direct property of the recording.

That distinction matters because AI-generated adversarial visual patterns can sometimes make a computer-vision model misinterpret an image. The camera may continue to record a clear scene for later human review, while the automated detector fails to produce the event that a business expected. It is better understood as a possible analytics blind spot than as a person becoming invisible.

What are adversarial visual patterns?

An adversarial example is an input designed to push a machine-learning model towards the wrong answer. In computer vision, researchers can optimise a visual change against a chosen model so that a person, vehicle or other object is less likely to be detected or is assigned the wrong class. The pixels have not disappeared. The model's interpretation has changed.

The idea is not new. Academic research has shown for years that image classifiers and object detectors can be sensitive to carefully constructed inputs, including inputs viewed through a camera. What is changing is the scale, accessibility and commercial framing of experiments: newer projects can search across many model families and present the result as a printed garment, panel or vehicle surface rather than as a file on a researcher's laptop.

This article deliberately does not publish patterns, code, optimisation settings or instructions for testing against cameras. Those details could make evasion easier. Businesses need to understand the risk and improve their controls without turning a security explainer into a how-to guide.

What the current research does — and does not — show

The noRecognition project, associated with researcher Bill Swearingen, is a useful current example. Its public research material describes a search process against production computer-vision models, including person and vehicle detectors. When checked on 31 August 2026, the project site reported 11 production models, more than 1 billion cumulative tests, 127 search arms and 12 held-out identities that were not used to build a pattern. The live counter and status are changing research metrics, not a certification of every camera on the market.

The same material makes a distinction that businesses should keep making: extensive laboratory or model testing is not the same as reliable performance through a real camera in a real location. As of that check, the research page said every figure was digital until printed fabric passed the same evaluation bar, with fabric trials under way. The DEF CON 34 slides described live fabric testing as just begun and said nothing physical was claimed yet. That leaves important variables such as print quality, lens processing, compression, distance, lighting, viewing angle, movement, weather and the camera's current firmware or model version.

Earlier reporting and presentation material may quote lower test totals or describe individual demonstrations. That is normal for a live research project, but it is also why a number copied from an article should not become a permanent procurement assumption. Check the original project's method, date and scope, then ask whether the evidence matches the system your business actually operates.

noRecognition: current research status and methodology →

noRecognition: DEF CON 34 presentation slides →

Adversarial Examples in the Physical World: a research survey →

The camera pipeline has several points of failure

A simplified camera security workflow looks like this:

1. 1The camera captures frames and sends or stores them.
2. 2A detector decides whether an object of interest appears in a frame.
3. 3A tracker links detections across frames and estimates movement.
4. 4A recognition model may identify a face, number plate, vehicle type or other attribute.
5. 5Business rules turn the result into a notification, access decision or incident record.

An adversarial visual input may affect one of those stages without stopping the recording. If the first detector does not find a person, a downstream face-recognition model may never receive a crop to analyse. If tracking is unstable, an alert based on crossing a line or remaining in a zone may not trigger. If an alert rule only trusts a high-confidence result, uncertainty can become a silent miss.

The reverse is also possible: the model may produce a false positive, attach the wrong label or behave normally in one camera view and poorly in another. Businesses should therefore measure both false negatives and false positives. A dashboard that only celebrates alerts generated is not measuring the events the system failed to report.

Why this matters to a small business

The risk is most relevant where an automated alert is treated as proof that something did or did not happen. Examples include a warehouse expecting a person-detection alert at a restricted door, a site using vehicle recognition to open a gate, a retailer relying on an automated incident queue, or a contractor assuming that every suspicious movement will be escalated.

• A missed detection can delay a response even though footage exists for later review.
• A false positive can waste staff time, create alert fatigue and encourage people to lower sensitivity.
• A model update can change results without changing the camera hardware or the physical site.
• Different camera positions can produce very different outcomes for the same person or vehicle.
• A supplier's average benchmark may hide the conditions that matter most at your entrance, yard, car park or loading bay.

This is not a reason to claim that AI cameras are useless. It is a reason to name the exact job they perform. An analytics alert can help a person decide where to look; it should not quietly become the only lock, guard, alarm, audit trail or safety decision in a high-consequence process.

Practical safeguards for CCTV and access control

Start with the consequence of a missed event. If the result is inconvenience, a notification may be enough. If the result could be theft, unauthorised access, a safety incident or a dispute about who entered a site, build a stronger control around the camera rather than assuming a confidence score solves the problem.

• Keep the original recording where there is a valid purpose and appropriate retention period. An alert is a pointer into the footage, not a replacement for the evidence.
• Use a human review step for consequential alerts. Give reviewers the surrounding frames, camera time, location and relevant access-control event instead of a cropped AI label alone.
• Layer the system with physical measures such as doors, locks, lighting, barriers, visitor procedures, staff checks and alarm contacts. Add another independent sensor where it genuinely reduces a known blind spot.
• Record model versions, camera firmware, configuration changes and periods when analytics were unavailable. A later investigation needs to show what the system could actually do at the time.
• Track missed events and nuisance alerts, not just successful detections. Revisit thresholds and placement with the supplier when performance drifts.
• Do not allow a single camera analytic to make an irreversible decision unless the risk assessment, testing evidence and fallback process justify it.

Questions to put to a camera supplier

Avoid accepting “AI-powered” as a performance specification. Ask the supplier to identify the complete processing chain and explain the evidence for the use case you are buying.

• Which model and version perform detection, tracking, recognition and alert generation?
• What are the measured false-negative and false-positive rates for our object types and operating conditions?
• Has the complete camera-to-alert system been tested with real printed or physical inputs, not only digital images or a vendor demo?
• How do lens angle, night lighting, rain, reflections, compression, distance and movement affect performance?
• How are model updates tested, approved, announced and rolled back when behaviour changes?
• Can we export original footage, analytic events, confidence values and system-health logs for an investigation?
• What happens when the analytic service is unavailable, uncertain or disconnected from the camera?
• Can an authorised customer run a controlled acceptance test without exposing staff, visitors or the public to unapproved surveillance experiments?

A responsible acceptance test should be agreed with the supplier, carried out by authorised people in a controlled location and designed to measure the system's limits without attempting to evade security in public. Define success, failure, data handling and stop conditions before the test begins.

Privacy, transparency and dual use

The same research can be described in two different ways. It may help defenders understand how a model can fail, or it may be marketed as a way to avoid surveillance. Businesses should keep both the security and privacy sides in view. Improving robustness can protect people and property; deploying more intrusive recognition because a camera is not trusted can create a different set of risks.

For UK organisations, the Information Commissioner's Office says video surveillance should be a necessary and proportionate response, with alternatives considered, the camera view restricted to what is relevant, a lawful basis identified and a data protection impact assessment carried out where processing is likely to create high risk. Facial recognition and ANPR can be particularly intrusive because they may affect people in public or semi-public spaces.

Be clear about what is recorded, what is inferred, who can see it, how long it is kept, which suppliers or subcontractors can access it and how a person can ask questions. If analytics are fallible, do not present an automated label as a fact. Explain the human review and appeal route where a camera event affects a person.

ICO guidance: using surveillance systems, including CCTV →

AI privacy controls for business data →

How this fits with wider security planning

A camera analytic is one identity and monitoring signal. It should sit inside a wider design that limits access, assumes components can fail and gives people a way to investigate exceptions. That is the same mindset used in good cyber security: do not give one control more authority than its evidence can support.

Review the camera network as well as the AI model. Protect camera accounts, segment devices where practical, restrict remote viewing, patch firmware, log administrator access and confirm what happens if the cloud service or local network is unavailable. A model can be accurate and still sit on an insecure camera platform.

Zero Trust Security: What Does It Actually Mean? →

What Should Your IT Provider Be Monitoring? →

Your Wi-Fi Could Soon Know When Someone Is in the Room →

IT Club view

The important lesson is not that a printed pattern can magically defeat every camera. It is that recording, detection, recognition and alerting are different capabilities, often delivered by different models and suppliers. A successful camera image does not guarantee a successful automated interpretation, and a successful alert does not prove that the system saw everything.

Businesses can respond sensibly: buy evidence rather than slogans, test the complete system in the real environment, preserve footage and logs, keep a person involved when the consequence matters and use physical and procedural controls around the analytic. Then review privacy and proportionality as part of the design, not as paperwork after installation.

If you are unsure whether your CCTV, access control or vehicle-recognition setup is giving you useful assurance, ask the IT Club Advisor. We can help turn a vague AI promise into a clear conversation about scope, evidence, failure modes, fallback controls and responsible use.

Ask the IT Club Advisor →

Further reading

Research methods, model capabilities and privacy guidance change. Check the original sources and your supplier's current documentation before making a security or surveillance decision.

How AI-generated patterns can make cameras look away →

AI needs guardrails: practical governance for business →